In information processing systems, messages are exchanged between different computers and between different software applications running on the same computer. For example, a computer, when detecting an error, may send an error message to another computer that performs management tasks. Message exchange makes it easier for a sending side and receiving side to share information about hardware and software states.
The message exchange may involve filtering messages at the sending side or receiving side. This means that messages to be subjected to further processing may be selected from a plurality of messages according to their contents. For example, an operating system or device driver running on a computer may output a log file containing a plurality of messages. In doing so, the computer may extract messages satisfying preset conditions (for example, messages indicating high priority errors), and send the messages to another computer. Such filtering leads to reducing the processing load on computers, the risk of erroneous state judgment, etc.
There has been proposed an apparatus for supporting definition of conditions for making log notifications. This apparatus collects and classifies log records output from a system being monitored by time zone, counts the number of log records indicating the same message for each time zone, and creates and displays candidate conditions for capturing all log records for each time zone.
Further, there has also been proposed a message monitoring system for promoting optimization of filters used for detecting messages. This message monitoring system accumulates information indicating detected messages and filters used for detecting the messages, extracts redundant filters that detect only the same messages as other filters, and outputs information indicating the redundant filters.
Still further, there has also been proposed an electronic mail filtering system which allows the filtering of electronic mails to be customized for each user. This electronic mail filtering system refers to a user-specific list of words with weights, and determines unwanted mail candidates out of received electronic mails. The electronic mail filtering system then analyzes the words included in unwanted electronic mails selected from the unwanted mail candidates, and reconfigures the list of words with weights.
Still further, there has also been an operation management system which sends a message for reporting insufficiency of filter definitions to a monitoring terminal device when the same mail that has not been registered in the filter definitions arrives a predetermined number of times or more in a predetermined time period.
Please see, for example, Japanese Laid-open Patent Publications Nos. 2008-41041, 2009-217392, 2003-67304, and 2009-64098 (paragraph [0015]).
Consider an information processing system in which filter information specifying the formats of messages to be extracted is prepared in order to extract messages to be subjected to further processing from a plurality of messages. Strictly defining the formats reduces a possibility of extracting unwanted messages. However, this approach of defining the formats of messages to be extracted in filter information has a problem that if software that outputs messages is updated, desired messages may not be extracted.
For example, in the case where a security patch is applied to an operating system or in the case where a device driver is updated, the formats of messages written in a log file may be changed. The format changes include a change in the number of spaces between words, a change in a delimiter, a change in word order, an addition of new words, etc. Messages in the changed formats do not match the formats defined in the existing filter information, and therefore are not extracted. However, it is desirable that messages substantially indicating the same contents are extracted even if the messages have changed formats.
This problem is a big issue for information processing systems which likely cause a time lag from change of the formats of messages to generation of filter information reflecting the changed formats. In this connection, the problem may generally occur not only in the case of extracting messages from a log file but also in the case of extracting desired messages from a plurality of messages.